@contember/schema-utils 2.1.0-alpha.13 → 2.1.0-alpha.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. package/dist/development/src/type-schema/acl.cjs +2 -2
  2. package/dist/development/src/type-schema/acl.cjs.map +1 -1
  3. package/dist/development/src/type-schema/acl.js +2 -2
  4. package/dist/development/src/type-schema/acl.js.map +1 -1
  5. package/dist/development/src/validation/MembershipResolver.cjs +10 -7
  6. package/dist/development/src/validation/MembershipResolver.cjs.map +1 -1
  7. package/dist/development/src/validation/MembershipResolver.js +10 -7
  8. package/dist/development/src/validation/MembershipResolver.js.map +1 -1
  9. package/dist/production/src/type-schema/acl.cjs +2 -2
  10. package/dist/production/src/type-schema/acl.cjs.map +1 -1
  11. package/dist/production/src/type-schema/acl.js +2 -2
  12. package/dist/production/src/type-schema/acl.js.map +1 -1
  13. package/dist/production/src/validation/MembershipResolver.cjs +10 -7
  14. package/dist/production/src/validation/MembershipResolver.cjs.map +1 -1
  15. package/dist/production/src/validation/MembershipResolver.js +10 -7
  16. package/dist/production/src/validation/MembershipResolver.js.map +1 -1
  17. package/dist/tests/tsconfig.tsbuildinfo +1 -1
  18. package/dist/types/tsconfig.tsbuildinfo +1 -1
  19. package/dist/types/validation/MembershipResolver.d.ts +1 -1
  20. package/dist/types/validation/MembershipResolver.d.ts.map +1 -1
  21. package/package.json +4 -4
  22. package/src/type-schema/acl.ts +2 -2
  23. package/src/validation/MembershipResolver.ts +10 -6
  24. package/tests/cases/unit/membershipResolver.test.ts +67 -8
package/dist/development/src/type-schema/acl.cjs CHANGED
@@ -20,7 +20,7 @@ function _interopNamespaceDefault(e) {
20
20
  return Object.freeze(n);
21
21
  }
22
22
  const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
23
- const membershipMatchRuleSchema = Typesafe__namespace.record(
23
+ const membershipMatchRuleSchema = Typesafe__namespace.union(Typesafe__namespace.boolean, Typesafe__namespace.record(
24
24
  Typesafe__namespace.string,
25
25
  Typesafe__namespace.union(
26
26
  Typesafe__namespace.literal(true),
@@ -34,7 +34,7 @@ const membershipMatchRuleSchema = Typesafe__namespace.record(
34
34
  )
35
35
  })
36
36
  )
37
- );
37
+ ));
38
38
  const tenantPermissionsSchema = Typesafe__namespace.partial({
39
39
  invite: Typesafe__namespace.union(Typesafe__namespace.boolean, membershipMatchRuleSchema),
40
40
  unmanagedInvite: Typesafe__namespace.union(Typesafe__namespace.boolean, membershipMatchRuleSchema),
package/dist/development/src/type-schema/acl.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"acl.cjs","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n)\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":["Typesafe","Acl","conditionSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,4BAA4BA,oBAAS;AAAA,EAC1CA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACRA,oBAAS,QAAQ,IAAI;AAAA,IACrBA,oBAAS,QAAQ;AAAA,MAChB,WAAWA,oBAAS;AAAA,QACnBA,oBAAS,QAAQ,IAAI;AAAA,QACrBA,oBAAS;AAAA,UACRA,oBAAS;AAAA,UACTA,oBAAS,MAAMA,oBAAS,QAAQ,IAAI,GAAGA,oBAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH;AAEA,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,QAAQA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiBA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,SAASA,oBAAS,MAAMA,oBAAS,SAASA,oBAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAASA,oBAAS;AAAA,EAClB,gBAAgBA,oBAAS;AAAA,EACzB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAClB,CAAC;AAGD,MAAM,2BAA2BA,oBAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAAA,EACjB,yBAAyBA,oBAAS;AACnC,CAAC;AAGD,MAAM,uBAAuBA,oBAAS;AAAA,EACrCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAYD,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2BF,oBAAS,OAAO;AAAA,EAChD,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,UAAU;AAAA,EAClD,OAAOD,oBAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0BA,oBAAS;AAAA,EACxCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAA,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACDD,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkBF,oBAAS;AAAA,EAChCA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyBA,oBAAS;AAAA,EACvCA,oBAAS;AAAA,EACTA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AACjD;AACA,MAAM,mBAAmBA,oBAAS;AAAA,EACjCA,oBAAS;AAAA,EACT,CAAC,GAAG,MAA+BA,oBAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyBA,oBAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AAAA,EACxD,eAAeA,oBAAS;AAAA,EACxB,yBAAyBA,oBAAS;AAAA,EAClC,QAAQA,oBAAS,MAAMA,oBAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiBA,oBAAS;AAAA,EAC/BA,oBAAS;AAAA,EACTA,oBAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4BA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IACxC,UAAUA,oBAAS;AAAA,IACnB,QAAQA,oBAAS;AAAA,MAChBA,oBAAS,QAAQ,GAAG;AAAA,MACpBA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAOA,oBAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAYA,oBAAS;AAAA,EACjCA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,MACfA,oBAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,eAAeA,oBAAS;AAAA,EACxB,CAAA;AACF;;"}
1
+ {"version":3,"file":"acl.cjs","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.union(Typesafe.boolean, Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n))\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":["Typesafe","Acl","conditionSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,4BAA4BA,oBAAS,MAAMA,oBAAS,SAASA,oBAAS;AAAA,EAC3EA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACRA,oBAAS,QAAQ,IAAI;AAAA,IACrBA,oBAAS,QAAQ;AAAA,MAChB,WAAWA,oBAAS;AAAA,QACnBA,oBAAS,QAAQ,IAAI;AAAA,QACrBA,oBAAS;AAAA,UACRA,oBAAS;AAAA,UACTA,oBAAS,MAAMA,oBAAS,QAAQ,IAAI,GAAGA,oBAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH,CAAC;AAED,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,QAAQA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiBA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,SAASA,oBAAS,MAAMA,oBAAS,SAASA,oBAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAASA,oBAAS;AAAA,EAClB,gBAAgBA,oBAAS;AAAA,EACzB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAClB,CAAC;AAGD,MAAM,2BAA2BA,oBAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAAA,EACjB,yBAAyBA,oBAAS;AACnC,CAAC;AAGD,MAAM,uBAAuBA,oBAAS;AAAA,EACrCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAYD,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2BF,oBAAS,OAAO;AAAA,EAChD,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,UAAU;AAAA,EAClD,OAAOD,oBAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0BA,oBAAS;AAAA,EACxCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAA,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACDD,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkBF,oBAAS;AAAA,EAChCA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyBA,oBAAS;AAAA,EACvCA,oBAAS;AAAA,EACTA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AACjD;AACA,MAAM,mBAAmBA,oBAAS;AAAA,EACjCA,oBAAS;AAAA,EACT,CAAC,GAAG,MAA+BA,oBAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyBA,oBAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AAAA,EACxD,eAAeA,oBAAS;AAAA,EACxB,yBAAyBA,oBAAS;AAAA,EAClC,QAAQA,oBAAS,MAAMA,oBAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiBA,oBAAS;AAAA,EAC/BA,oBAAS;AAAA,EACTA,oBAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4BA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IACxC,UAAUA,oBAAS;AAAA,IACnB,QAAQA,oBAAS;AAAA,MAChBA,oBAAS,QAAQ,GAAG;AAAA,MACpBA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAOA,oBAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAYA,oBAAS;AAAA,EACjCA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,MACfA,oBAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,eAAeA,oBAAS;AAAA,EACxB,CAAA;AACF;;"}
package/dist/development/src/type-schema/acl.js CHANGED
@@ -1,7 +1,7 @@
1
1
  import { Acl } from "@contember/schema";
2
2
  import * as Typesafe from "@contember/typesafe";
3
3
  import { conditionSchema } from "./condition.js";
4
- const membershipMatchRuleSchema = Typesafe.record(
4
+ const membershipMatchRuleSchema = Typesafe.union(Typesafe.boolean, Typesafe.record(
5
5
  Typesafe.string,
6
6
  Typesafe.union(
7
7
  Typesafe.literal(true),
@@ -15,7 +15,7 @@ const membershipMatchRuleSchema = Typesafe.record(
15
15
  )
16
16
  })
17
17
  )
18
- );
18
+ ));
19
19
  const tenantPermissionsSchema = Typesafe.partial({
20
20
  invite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),
21
21
  unmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),
package/dist/development/src/type-schema/acl.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"acl.js","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n)\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":[],"mappings":";;;AAIA,MAAM,4BAA4B,SAAS;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACR,SAAS,QAAQ,IAAI;AAAA,IACrB,SAAS,QAAQ;AAAA,MAChB,WAAW,SAAS;AAAA,QACnB,SAAS,QAAQ,IAAI;AAAA,QACrB,SAAS;AAAA,UACR,SAAS;AAAA,UACT,SAAS,MAAM,SAAS,QAAQ,IAAI,GAAG,SAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH;AAEA,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,QAAQ,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiB,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,SAAS,SAAS,MAAM,SAAS,SAAS,SAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAAS,SAAS;AAAA,EAClB,gBAAgB,SAAS;AAAA,EACzB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAClB,CAAC;AAGD,MAAM,2BAA2B,SAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAAA,EACjB,yBAAyB,SAAS;AACnC,CAAC;AAGD,MAAM,uBAAuB,SAAS;AAAA,EACrC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2B,SAAS,OAAO;AAAA,EAChD,MAAM,SAAS,QAAQ,IAAI,aAAa,UAAU;AAAA,EAClD,OAAO,SAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0B,SAAS;AAAA,EACxC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkB,SAAS;AAAA,EAChC,SAAS;AAAA,EACT,SAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyB,SAAS;AAAA,EACvC,SAAS;AAAA,EACT,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AACjD;AACA,MAAM,mBAAmB,SAAS;AAAA,EACjC,SAAS;AAAA,EACT,CAAC,GAAG,MAA+B,SAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyB,SAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AAAA,EACxD,eAAe,SAAS;AAAA,EACxB,yBAAyB,SAAS;AAAA,EAClC,QAAQ,SAAS,MAAM,SAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiB,SAAS;AAAA,EAC/B,SAAS;AAAA,EACT,SAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4B,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,IACxC,UAAU,SAAS;AAAA,IACnB,QAAQ,SAAS;AAAA,MAChB,SAAS,QAAQ,GAAG;AAAA,MACpB,SAAS,MAAM,SAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAO,SAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAY,SAAS;AAAA,EACjC,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,MACf,SAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,eAAe,SAAS;AAAA,EACxB,CAAA;AACF;"}
1
+ {"version":3,"file":"acl.js","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.union(Typesafe.boolean, Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n))\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":[],"mappings":";;;AAIA,MAAM,4BAA4B,SAAS,MAAM,SAAS,SAAS,SAAS;AAAA,EAC3E,SAAS;AAAA,EACT,SAAS;AAAA,IACR,SAAS,QAAQ,IAAI;AAAA,IACrB,SAAS,QAAQ;AAAA,MAChB,WAAW,SAAS;AAAA,QACnB,SAAS,QAAQ,IAAI;AAAA,QACrB,SAAS;AAAA,UACR,SAAS;AAAA,UACT,SAAS,MAAM,SAAS,QAAQ,IAAI,GAAG,SAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH,CAAC;AAED,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,QAAQ,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiB,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,SAAS,SAAS,MAAM,SAAS,SAAS,SAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAAS,SAAS;AAAA,EAClB,gBAAgB,SAAS;AAAA,EACzB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAClB,CAAC;AAGD,MAAM,2BAA2B,SAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAAA,EACjB,yBAAyB,SAAS;AACnC,CAAC;AAGD,MAAM,uBAAuB,SAAS;AAAA,EACrC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2B,SAAS,OAAO;AAAA,EAChD,MAAM,SAAS,QAAQ,IAAI,aAAa,UAAU;AAAA,EAClD,OAAO,SAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0B,SAAS;AAAA,EACxC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkB,SAAS;AAAA,EAChC,SAAS;AAAA,EACT,SAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyB,SAAS;AAAA,EACvC,SAAS;AAAA,EACT,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AACjD;AACA,MAAM,mBAAmB,SAAS;AAAA,EACjC,SAAS;AAAA,EACT,CAAC,GAAG,MAA+B,SAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyB,SAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AAAA,EACxD,eAAe,SAAS;AAAA,EACxB,yBAAyB,SAAS;AAAA,EAClC,QAAQ,SAAS,MAAM,SAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiB,SAAS;AAAA,EAC/B,SAAS;AAAA,EACT,SAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4B,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,IACxC,UAAU,SAAS;AAAA,IACnB,QAAQ,SAAS;AAAA,MAChB,SAAS,QAAQ,GAAG;AAAA,MACpB,SAAS,MAAM,SAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAO,SAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAY,SAAS;AAAA,EACjC,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,MACf,SAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,eAAe,SAAS;AAAA,EACxB,CAAA;AACF;"}
package/dist/development/src/validation/MembershipResolver.cjs CHANGED
@@ -12,7 +12,7 @@ var __defProp = Object.defineProperty;
12
12
  var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
13
13
  var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
14
14
  class MembershipResolver {
15
- resolve(acl, memberships, identity) {
15
+ resolve(acl, memberships, identity, isAssumed) {
16
16
  const errors = [];
17
17
  const parsed = [];
18
18
  const roles = acl.roles;
@@ -27,7 +27,7 @@ class MembershipResolver {
27
27
  }
28
28
  const roleVariables = schemaUtils.getRoleVariables(membership.role, acl);
29
29
  for (const variable of membership.variables) {
30
- if (!roleVariables[variable.name] || roleVariables[variable.name].type === schema.Acl.VariableType.predefined) {
30
+ if (!roleVariables[variable.name] || !isAssumed && roleVariables[variable.name].type === schema.Acl.VariableType.predefined) {
31
31
  errors.push(
32
32
  new MembershipValidationError(
33
33
  membership.role,
@@ -37,7 +37,7 @@ class MembershipResolver {
37
37
  );
38
38
  }
39
39
  }
40
- const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity);
40
+ const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed);
41
41
  errors.push(...membershipErrors);
42
42
  parsed.push({
43
43
  role: membership.role,
@@ -46,19 +46,23 @@ class MembershipResolver {
46
46
  }
47
47
  return new MembershipReadResult(errors, parsed);
48
48
  }
49
- readMembershipVariables(roleVariables, membership, identity) {
49
+ readMembershipVariables(roleVariables, membership, identity, isAssumed) {
50
50
  const errors = [];
51
51
  const parsedVariables = [];
52
52
  for (const [name, variable] of Object.entries(roleVariables)) {
53
+ const inputVariable = membership.variables.find((it) => it.name === name);
53
54
  if (variable.type === schema.Acl.VariableType.predefined) {
54
55
  switch (variable.value) {
55
56
  case "identityID":
56
- parsedVariables.push({ name, condition: { in: [identity.identityId] } });
57
+ parsedVariables.push({
58
+ name,
59
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] }
60
+ });
57
61
  break;
58
62
  case "personID":
59
63
  parsedVariables.push({
60
64
  name,
61
- condition: { in: identity.personId ? [identity.personId] : [] }
65
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] }
62
66
  });
63
67
  break;
64
68
  default:
@@ -68,7 +72,6 @@ class MembershipResolver {
68
72
  }
69
73
  continue;
70
74
  }
71
- const inputVariable = membership.variables.find((it) => it.name === name);
72
75
  if (!inputVariable) {
73
76
  if (variable.fallback) {
74
77
  parsedVariables.push({ name, condition: variable.fallback });
package/dist/development/src/validation/MembershipResolver.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"MembershipResolver.cjs","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl'\nimport { conditionSchema } from '../type-schema'\nimport { assertNever } from '../utils'\n\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tif (!roleVariables[variable.name] || roleVariables[variable.name].type === Acl.VariableType.predefined) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { in: [identity.identityId] } })\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["getRoleVariables","Acl","conditionSchema","assertNever","MembershipValidationErrorType"],"mappings":";;;;;;;;;;;;;AAMO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIuB;AACvB,UAAM,SAAsC,CAAC;AAC7C,UAAM,SAA6B,CAAC;AACpC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AACrC,UAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC5B,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MAAA;AAED,YAAM,gBAAgBA,YAAA,iBAAiB,WAAW,MAAM,GAAG;AAChD,iBAAA,YAAY,WAAW,WAAW;AAC5C,YAAI,CAAC,cAAc,SAAS,IAAI,KAAK,cAAc,SAAS,IAAI,EAAE,SAASC,WAAI,aAAa,YAAY;AAChG,iBAAA;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UAEX;AAAA,QAAA;AAAA,MACD;AAEK,YAAA,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,QAAQ;AACrG,aAAA,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IAAA;AAEK,WAAA,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAAA;AAAA,EAGvC,wBAAwB,eAA8B,YAA4B,UAG5B;AAC7D,UAAM,SAAsC,CAAC;AAC7C,UAAM,kBAA8C,CAAC;AACrD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,UAAI,SAAS,SAASA,WAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAO;AAAA,UACvB,KAAK;AACY,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,CAAC,SAAS,UAAU,EAAE,GAAG;AACvE;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAG,EAAA;AAAA,YAAA,CAC9D;AACD;AAAA,UACD;AACiB,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MAAA;AAGD,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAM,OAAA,GAAG,SAAS,IAAI;AACtE,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAAA,OACrD;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9F,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAE1D;AAAA,MAAA;AAGD,UAAI,SAAS,SAASA,WAAI,aAAa,QAAQ;AAC9B,wBAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAO,GAAG;AAAA,MAE5D,WAAA,SAAS,SAASA,OAAAA,IAAI,aAAa,WAAW;AACpD,YAAA;AACG,gBAAA,aAAa,cAAc,OAAO,IAAI,CAAA,OAAMC,UAAgB,gBAAA,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW;AAAA,UAAA,CACtE;AAAA,QAAA,QACM;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChG,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAAA,MAC1D,OACM;AACNC,oBAAAA,YAAoB;AAAA,MAAA;AAAA,IACrB;AAEM,WAAA,CAAC,QAAQ,eAAe;AAAA,EAAA;AAEjC;AAjGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAuC,CAAA;AAmG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAGlB;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAGlB;AAEY,IAAA,kDAAAC,mCAAL;AACNA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,oBAAqB,IAAA;AACrBA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,kBAAmB,IAAA;AAJRA,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;;;;;"}
1
+ {"version":3,"file":"MembershipResolver.cjs","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl'\nimport { conditionSchema } from '../type-schema'\nimport { assertNever } from '../utils'\n\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t\tisAssumed: boolean,\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tif (!roleVariables[variable.name] || (!isAssumed && roleVariables[variable.name].type === Acl.VariableType.predefined)) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}, isAssumed: boolean): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["getRoleVariables","Acl","conditionSchema","assertNever","MembershipValidationErrorType"],"mappings":";;;;;;;;;;;;;AAMO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIA,WACuB;AACvB,UAAM,SAAsC,CAAC;AAC7C,UAAM,SAA6B,CAAC;AACpC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AACrC,UAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC5B,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MAAA;AAED,YAAM,gBAAgBA,YAAA,iBAAiB,WAAW,MAAM,GAAG;AAChD,iBAAA,YAAY,WAAW,WAAW;AAC5C,YAAI,CAAC,cAAc,SAAS,IAAI,KAAM,CAAC,aAAa,cAAc,SAAS,IAAI,EAAE,SAASC,OAAAA,IAAI,aAAa,YAAa;AAChH,iBAAA;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UAEX;AAAA,QAAA;AAAA,MACD;AAEK,YAAA,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,UAAU,SAAS;AAChH,aAAA,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IAAA;AAEK,WAAA,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAAA;AAAA,EAGvC,wBAAwB,eAA8B,YAA4B,UAGvF,WAA+E;AACjF,UAAM,SAAsC,CAAC;AAC7C,UAAM,kBAA8C,CAAC;AACrD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAM,OAAA,GAAG,SAAS,IAAI;AACtE,UAAI,SAAS,SAASA,WAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAO;AAAA,UACvB,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,CAAC,SAAS,UAAU,EAAE;AAAA,YAAA,CAC3F;AACD;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAG,EAAA;AAAA,YAAA,CAClH;AACD;AAAA,UACD;AACiB,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MAAA;AAGD,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAAA,OACrD;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9F,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAE1D;AAAA,MAAA;AAGD,UAAI,SAAS,SAASA,WAAI,aAAa,QAAQ;AAC9B,wBAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAO,GAAG;AAAA,MAE5D,WAAA,SAAS,SAASA,OAAAA,IAAI,aAAa,WAAW;AACpD,YAAA;AACG,gBAAA,aAAa,cAAc,OAAO,IAAI,CAAA,OAAMC,UAAgB,gBAAA,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW;AAAA,UAAA,CACtE;AAAA,QAAA,QACM;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChG,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAAA,MAC1D,OACM;AACNC,oBAAAA,YAAoB;AAAA,MAAA;AAAA,IACrB;AAEM,WAAA,CAAC,QAAQ,eAAe;AAAA,EAAA;AAEjC;AArGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAuC,CAAA;AAuG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAGlB;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAGlB;AAEY,IAAA,kDAAAC,mCAAL;AACNA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,oBAAqB,IAAA;AACrBA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,kBAAmB,IAAA;AAJRA,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;;;;;"}
package/dist/development/src/validation/MembershipResolver.js CHANGED
@@ -10,7 +10,7 @@ var __defProp = Object.defineProperty;
10
10
  var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
11
11
  var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
12
12
  class MembershipResolver {
13
- resolve(acl, memberships, identity) {
13
+ resolve(acl, memberships, identity, isAssumed) {
14
14
  const errors = [];
15
15
  const parsed = [];
16
16
  const roles = acl.roles;
@@ -25,7 +25,7 @@ class MembershipResolver {
25
25
  }
26
26
  const roleVariables = getRoleVariables(membership.role, acl);
27
27
  for (const variable of membership.variables) {
28
- if (!roleVariables[variable.name] || roleVariables[variable.name].type === Acl.VariableType.predefined) {
28
+ if (!roleVariables[variable.name] || !isAssumed && roleVariables[variable.name].type === Acl.VariableType.predefined) {
29
29
  errors.push(
30
30
  new MembershipValidationError(
31
31
  membership.role,
@@ -35,7 +35,7 @@ class MembershipResolver {
35
35
  );
36
36
  }
37
37
  }
38
- const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity);
38
+ const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed);
39
39
  errors.push(...membershipErrors);
40
40
  parsed.push({
41
41
  role: membership.role,
@@ -44,19 +44,23 @@ class MembershipResolver {
44
44
  }
45
45
  return new MembershipReadResult(errors, parsed);
46
46
  }
47
- readMembershipVariables(roleVariables, membership, identity) {
47
+ readMembershipVariables(roleVariables, membership, identity, isAssumed) {
48
48
  const errors = [];
49
49
  const parsedVariables = [];
50
50
  for (const [name, variable] of Object.entries(roleVariables)) {
51
+ const inputVariable = membership.variables.find((it) => it.name === name);
51
52
  if (variable.type === Acl.VariableType.predefined) {
52
53
  switch (variable.value) {
53
54
  case "identityID":
54
- parsedVariables.push({ name, condition: { in: [identity.identityId] } });
55
+ parsedVariables.push({
56
+ name,
57
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] }
58
+ });
55
59
  break;
56
60
  case "personID":
57
61
  parsedVariables.push({
58
62
  name,
59
- condition: { in: identity.personId ? [identity.personId] : [] }
63
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] }
60
64
  });
61
65
  break;
62
66
  default:
@@ -66,7 +70,6 @@ class MembershipResolver {
66
70
  }
67
71
  continue;
68
72
  }
69
- const inputVariable = membership.variables.find((it) => it.name === name);
70
73
  if (!inputVariable) {
71
74
  if (variable.fallback) {
72
75
  parsedVariables.push({ name, condition: variable.fallback });
package/dist/development/src/validation/MembershipResolver.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"MembershipResolver.js","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl'\nimport { conditionSchema } from '../type-schema'\nimport { assertNever } from '../utils'\n\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tif (!roleVariables[variable.name] || roleVariables[variable.name].type === Acl.VariableType.predefined) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { in: [identity.identityId] } })\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["MembershipValidationErrorType"],"mappings":";;;;;;;;;;;AAMO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIuB;AACvB,UAAM,SAAsC,CAAC;AAC7C,UAAM,SAA6B,CAAC;AACpC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AACrC,UAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC5B,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MAAA;AAED,YAAM,gBAAgB,iBAAiB,WAAW,MAAM,GAAG;AAChD,iBAAA,YAAY,WAAW,WAAW;AAC5C,YAAI,CAAC,cAAc,SAAS,IAAI,KAAK,cAAc,SAAS,IAAI,EAAE,SAAS,IAAI,aAAa,YAAY;AAChG,iBAAA;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UAEX;AAAA,QAAA;AAAA,MACD;AAEK,YAAA,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,QAAQ;AACrG,aAAA,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IAAA;AAEK,WAAA,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAAA;AAAA,EAGvC,wBAAwB,eAA8B,YAA4B,UAG5B;AAC7D,UAAM,SAAsC,CAAC;AAC7C,UAAM,kBAA8C,CAAC;AACrD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,UAAI,SAAS,SAAS,IAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAO;AAAA,UACvB,KAAK;AACY,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,CAAC,SAAS,UAAU,EAAE,GAAG;AACvE;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAG,EAAA;AAAA,YAAA,CAC9D;AACD;AAAA,UACD;AACiB,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MAAA;AAGD,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAM,OAAA,GAAG,SAAS,IAAI;AACtE,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAAA,OACrD;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9F,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAE1D;AAAA,MAAA;AAGD,UAAI,SAAS,SAAS,IAAI,aAAa,QAAQ;AAC9B,wBAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAO,GAAG;AAAA,MAE5D,WAAA,SAAS,SAAS,IAAI,aAAa,WAAW;AACpD,YAAA;AACG,gBAAA,aAAa,cAAc,OAAO,IAAI,CAAA,OAAM,gBAAgB,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW;AAAA,UAAA,CACtE;AAAA,QAAA,QACM;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChG,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAAA,MAC1D,OACM;AACN,oBAAoB;AAAA,MAAA;AAAA,IACrB;AAEM,WAAA,CAAC,QAAQ,eAAe;AAAA,EAAA;AAEjC;AAjGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAuC,CAAA;AAmG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAGlB;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAGlB;AAEY,IAAA,kDAAAA,mCAAL;AACNA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,oBAAqB,IAAA;AACrBA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,kBAAmB,IAAA;AAJRA,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;"}
1
+ {"version":3,"file":"MembershipResolver.js","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl'\nimport { conditionSchema } from '../type-schema'\nimport { assertNever } from '../utils'\n\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t\tisAssumed: boolean,\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tif (!roleVariables[variable.name] || (!isAssumed && roleVariables[variable.name].type === Acl.VariableType.predefined)) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}, isAssumed: boolean): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["MembershipValidationErrorType"],"mappings":";;;;;;;;;;;AAMO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIA,WACuB;AACvB,UAAM,SAAsC,CAAC;AAC7C,UAAM,SAA6B,CAAC;AACpC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AACrC,UAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC5B,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MAAA;AAED,YAAM,gBAAgB,iBAAiB,WAAW,MAAM,GAAG;AAChD,iBAAA,YAAY,WAAW,WAAW;AAC5C,YAAI,CAAC,cAAc,SAAS,IAAI,KAAM,CAAC,aAAa,cAAc,SAAS,IAAI,EAAE,SAAS,IAAI,aAAa,YAAa;AAChH,iBAAA;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UAEX;AAAA,QAAA;AAAA,MACD;AAEK,YAAA,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,UAAU,SAAS;AAChH,aAAA,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IAAA;AAEK,WAAA,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAAA;AAAA,EAGvC,wBAAwB,eAA8B,YAA4B,UAGvF,WAA+E;AACjF,UAAM,SAAsC,CAAC;AAC7C,UAAM,kBAA8C,CAAC;AACrD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAM,OAAA,GAAG,SAAS,IAAI;AACtE,UAAI,SAAS,SAAS,IAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAO;AAAA,UACvB,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,CAAC,SAAS,UAAU,EAAE;AAAA,YAAA,CAC3F;AACD;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAG,EAAA;AAAA,YAAA,CAClH;AACD;AAAA,UACD;AACiB,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MAAA;AAGD,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAAA,OACrD;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9F,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAE1D;AAAA,MAAA;AAGD,UAAI,SAAS,SAAS,IAAI,aAAa,QAAQ;AAC9B,wBAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAO,GAAG;AAAA,MAE5D,WAAA,SAAS,SAAS,IAAI,aAAa,WAAW;AACpD,YAAA;AACG,gBAAA,aAAa,cAAc,OAAO,IAAI,CAAA,OAAM,gBAAgB,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW;AAAA,UAAA,CACtE;AAAA,QAAA,QACM;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChG,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAAA,MAC1D,OACM;AACN,oBAAoB;AAAA,MAAA;AAAA,IACrB;AAEM,WAAA,CAAC,QAAQ,eAAe;AAAA,EAAA;AAEjC;AArGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAuC,CAAA;AAuG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAGlB;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAGlB;AAEY,IAAA,kDAAAA,mCAAL;AACNA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,oBAAqB,IAAA;AACrBA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,kBAAmB,IAAA;AAJRA,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;"}
package/dist/production/src/type-schema/acl.cjs CHANGED
@@ -20,7 +20,7 @@ function _interopNamespaceDefault(e) {
20
20
  return Object.freeze(n);
21
21
  }
22
22
  const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
23
- const membershipMatchRuleSchema = Typesafe__namespace.record(
23
+ const membershipMatchRuleSchema = Typesafe__namespace.union(Typesafe__namespace.boolean, Typesafe__namespace.record(
24
24
  Typesafe__namespace.string,
25
25
  Typesafe__namespace.union(
26
26
  Typesafe__namespace.literal(true),
@@ -34,7 +34,7 @@ const membershipMatchRuleSchema = Typesafe__namespace.record(
34
34
  )
35
35
  })
36
36
  )
37
- );
37
+ ));
38
38
  const tenantPermissionsSchema = Typesafe__namespace.partial({
39
39
  invite: Typesafe__namespace.union(Typesafe__namespace.boolean, membershipMatchRuleSchema),
40
40
  unmanagedInvite: Typesafe__namespace.union(Typesafe__namespace.boolean, membershipMatchRuleSchema),
package/dist/production/src/type-schema/acl.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"acl.cjs","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n)\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":["Typesafe","Acl","conditionSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,4BAA4BA,oBAAS;AAAA,EAC1CA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACRA,oBAAS,QAAQ,IAAI;AAAA,IACrBA,oBAAS,QAAQ;AAAA,MAChB,WAAWA,oBAAS;AAAA,QACnBA,oBAAS,QAAQ,IAAI;AAAA,QACrBA,oBAAS;AAAA,UACRA,oBAAS;AAAA,UACTA,oBAAS,MAAMA,oBAAS,QAAQ,IAAI,GAAGA,oBAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH;AAEA,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,QAAQA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiBA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,SAASA,oBAAS,MAAMA,oBAAS,SAASA,oBAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAASA,oBAAS;AAAA,EAClB,gBAAgBA,oBAAS;AAAA,EACzB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAClB,CAAC;AAGD,MAAM,2BAA2BA,oBAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAAA,EACjB,yBAAyBA,oBAAS;AACnC,CAAC;AAGD,MAAM,uBAAuBA,oBAAS;AAAA,EACrCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAYD,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2BF,oBAAS,OAAO;AAAA,EAChD,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,UAAU;AAAA,EAClD,OAAOD,oBAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0BA,oBAAS;AAAA,EACxCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAA,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACDD,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkBF,oBAAS;AAAA,EAChCA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyBA,oBAAS;AAAA,EACvCA,oBAAS;AAAA,EACTA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AACjD;AACA,MAAM,mBAAmBA,oBAAS;AAAA,EACjCA,oBAAS;AAAA,EACT,CAAC,GAAG,MAA+BA,oBAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyBA,oBAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AAAA,EACxD,eAAeA,oBAAS;AAAA,EACxB,yBAAyBA,oBAAS;AAAA,EAClC,QAAQA,oBAAS,MAAMA,oBAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiBA,oBAAS;AAAA,EAC/BA,oBAAS;AAAA,EACTA,oBAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4BA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IACxC,UAAUA,oBAAS;AAAA,IACnB,QAAQA,oBAAS;AAAA,MAChBA,oBAAS,QAAQ,GAAG;AAAA,MACpBA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAOA,oBAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAYA,oBAAS;AAAA,EACjCA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,MACfA,oBAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,eAAeA,oBAAS;AAAA,EACxB,CAAA;AACF;;"}
1
+ {"version":3,"file":"acl.cjs","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.union(Typesafe.boolean, Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n))\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":["Typesafe","Acl","conditionSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,4BAA4BA,oBAAS,MAAMA,oBAAS,SAASA,oBAAS;AAAA,EAC3EA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACRA,oBAAS,QAAQ,IAAI;AAAA,IACrBA,oBAAS,QAAQ;AAAA,MAChB,WAAWA,oBAAS;AAAA,QACnBA,oBAAS,QAAQ,IAAI;AAAA,QACrBA,oBAAS;AAAA,UACRA,oBAAS;AAAA,UACTA,oBAAS,MAAMA,oBAAS,QAAQ,IAAI,GAAGA,oBAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH,CAAC;AAED,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,QAAQA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiBA,oBAAS,MAAMA,oBAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0BA,oBAAS,QAAQ;AAAA,EAChD,SAASA,oBAAS,MAAMA,oBAAS,SAASA,oBAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAASA,oBAAS;AAAA,EAClB,gBAAgBA,oBAAS;AAAA,EACzB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAClB,CAAC;AAGD,MAAM,2BAA2BA,oBAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQA,oBAAS;AAAA,EACjB,QAAQA,oBAAS;AAAA,EACjB,yBAAyBA,oBAAS;AACnC,CAAC;AAGD,MAAM,uBAAuBA,oBAAS;AAAA,EACrCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAYD,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2BF,oBAAS,OAAO;AAAA,EAChD,MAAMA,oBAAS,QAAQC,OAAAA,IAAI,aAAa,UAAU;AAAA,EAClD,OAAOD,oBAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0BA,oBAAS;AAAA,EACxCA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS,QAAQC,OAAA,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACDD,oBAAS,QAAQ;AAAA,IAChB,UAAUE,UAAgB,gBAAA;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkBF,oBAAS;AAAA,EAChCA,oBAAS;AAAA,EACTA,oBAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyBA,oBAAS;AAAA,EACvCA,oBAAS;AAAA,EACTA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AACjD;AACA,MAAM,mBAAmBA,oBAAS;AAAA,EACjCA,oBAAS;AAAA,EACT,CAAC,GAAG,MAA+BA,oBAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyBA,oBAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQA,oBAAS,MAAMA,oBAAS,QAAQA,oBAAS,OAAO;AAAA,EACxD,eAAeA,oBAAS;AAAA,EACxB,yBAAyBA,oBAAS;AAAA,EAClC,QAAQA,oBAAS,MAAMA,oBAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiBA,oBAAS;AAAA,EAC/BA,oBAAS;AAAA,EACTA,oBAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4BA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,UAAUA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IACxC,UAAUA,oBAAS;AAAA,IACnB,QAAQA,oBAAS;AAAA,MAChBA,oBAAS,QAAQ,GAAG;AAAA,MACpBA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAOA,oBAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAYA,oBAAS;AAAA,EACjCA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,MACfA,oBAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,eAAeA,oBAAS;AAAA,EACxB,CAAA;AACF;;"}
package/dist/production/src/type-schema/acl.js CHANGED
@@ -1,7 +1,7 @@
1
1
  import { Acl } from "@contember/schema";
2
2
  import * as Typesafe from "@contember/typesafe";
3
3
  import { conditionSchema } from "./condition.js";
4
- const membershipMatchRuleSchema = Typesafe.record(
4
+ const membershipMatchRuleSchema = Typesafe.union(Typesafe.boolean, Typesafe.record(
5
5
  Typesafe.string,
6
6
  Typesafe.union(
7
7
  Typesafe.literal(true),
@@ -15,7 +15,7 @@ const membershipMatchRuleSchema = Typesafe.record(
15
15
  )
16
16
  })
17
17
  )
18
- );
18
+ ));
19
19
  const tenantPermissionsSchema = Typesafe.partial({
20
20
  invite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),
21
21
  unmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),
package/dist/production/src/type-schema/acl.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"acl.js","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n)\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":[],"mappings":";;;AAIA,MAAM,4BAA4B,SAAS;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACR,SAAS,QAAQ,IAAI;AAAA,IACrB,SAAS,QAAQ;AAAA,MAChB,WAAW,SAAS;AAAA,QACnB,SAAS,QAAQ,IAAI;AAAA,QACrB,SAAS;AAAA,UACR,SAAS;AAAA,UACT,SAAS,MAAM,SAAS,QAAQ,IAAI,GAAG,SAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH;AAEA,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,QAAQ,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiB,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,SAAS,SAAS,MAAM,SAAS,SAAS,SAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAAS,SAAS;AAAA,EAClB,gBAAgB,SAAS;AAAA,EACzB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAClB,CAAC;AAGD,MAAM,2BAA2B,SAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAAA,EACjB,yBAAyB,SAAS;AACnC,CAAC;AAGD,MAAM,uBAAuB,SAAS;AAAA,EACrC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2B,SAAS,OAAO;AAAA,EAChD,MAAM,SAAS,QAAQ,IAAI,aAAa,UAAU;AAAA,EAClD,OAAO,SAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0B,SAAS;AAAA,EACxC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkB,SAAS;AAAA,EAChC,SAAS;AAAA,EACT,SAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyB,SAAS;AAAA,EACvC,SAAS;AAAA,EACT,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AACjD;AACA,MAAM,mBAAmB,SAAS;AAAA,EACjC,SAAS;AAAA,EACT,CAAC,GAAG,MAA+B,SAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyB,SAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AAAA,EACxD,eAAe,SAAS;AAAA,EACxB,yBAAyB,SAAS;AAAA,EAClC,QAAQ,SAAS,MAAM,SAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiB,SAAS;AAAA,EAC/B,SAAS;AAAA,EACT,SAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4B,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,IACxC,UAAU,SAAS;AAAA,IACnB,QAAQ,SAAS;AAAA,MAChB,SAAS,QAAQ,GAAG;AAAA,MACpB,SAAS,MAAM,SAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAO,SAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAY,SAAS;AAAA,EACjC,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,MACf,SAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,eAAe,SAAS;AAAA,EACxB,CAAA;AACF;"}
1
+ {"version":3,"file":"acl.js","sources":["../../../../../packages/schema-utils/src/type-schema/acl.ts"],"sourcesContent":["import { Acl, Model } from '@contember/schema'\nimport * as Typesafe from '@contember/typesafe'\nimport { conditionSchema } from './condition'\n\nconst membershipMatchRuleSchema = Typesafe.union(Typesafe.boolean, Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tTypesafe.literal(true),\n\t\tTypesafe.partial({\n\t\t\tvariables: Typesafe.union(\n\t\t\t\tTypesafe.literal(true),\n\t\t\t\tTypesafe.record(\n\t\t\t\t\tTypesafe.string,\n\t\t\t\t\tTypesafe.union(Typesafe.literal(true), Typesafe.string),\n\t\t\t\t),\n\t\t\t),\n\t\t}),\n\t),\n))\n\nconst tenantPermissionsSchema = Typesafe.partial({\n\tinvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tunmanagedInvite: Typesafe.union(Typesafe.boolean, membershipMatchRuleSchema),\n\tmanage: membershipMatchRuleSchema,\n\tview: membershipMatchRuleSchema,\n})\nconst tenantSchemaCheck: Typesafe.Equals<Acl.TenantPermissions, ReturnType<typeof tenantPermissionsSchema>> = true\n\nconst systemPermissionsSchema = Typesafe.partial({\n\thistory: Typesafe.union(Typesafe.boolean, Typesafe.enumeration('any', 'none')),\n\tmigrate: Typesafe.boolean,\n\tassumeIdentity: Typesafe.boolean,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n})\nconst systemSchemaCheck: Typesafe.Equals<Acl.SystemPermissions, ReturnType<typeof systemPermissionsSchema>> = true\n\nconst contentPermissionsSchema = Typesafe.partial({\n\tassumeMembership: membershipMatchRuleSchema,\n\texport: Typesafe.boolean,\n\timport: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n})\nconst contentSchemaCheck: Typesafe.Equals<Acl.ContentPermissions, ReturnType<typeof contentPermissionsSchema>> = true\n\nconst entityVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.entity),\n\t\tentityName: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst entityVariableSchemaCheck: Typesafe.Equals<Acl.EntityVariable, ReturnType<typeof entityVariableSchema>> = true\n\nconst predefinedVariableSchema = Typesafe.object({\n\ttype: Typesafe.literal(Acl.VariableType.predefined),\n\tvalue: Typesafe.enumeration('identityID', 'personID'),\n})\nconst conditionVariableSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\ttype: Typesafe.literal(Acl.VariableType.condition),\n\t}),\n\tTypesafe.partial({\n\t\tfallback: conditionSchema(),\n\t}),\n)\nconst conditionVariableSchemaCheck: Typesafe.Equals<Acl.ConditionVariable, ReturnType<typeof conditionVariableSchema>> = true\n\nconst variablesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(\n\t\tentityVariableSchema as Typesafe.Type<Acl.EntityVariable>,\n\t\tpredefinedVariableSchema,\n\t\tconditionVariableSchema as Typesafe.Type<Acl.ConditionVariable>,\n\t),\n)\n\nconst variableSchemaCheck: Typesafe.Equals<Acl.Variables, ReturnType<typeof variablesSchema>> = true\n\nconst fieldPermissionsSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.union(Typesafe.string, Typesafe.boolean),\n)\nconst predicatesSchema = Typesafe.record(\n\tTypesafe.string,\n\t(v, p): Acl.PredicateDefinition => Typesafe.anyJsonObject(v, p) as Acl.PredicateDefinition,\n)\n\nconst predicatesSchemaCheck: Typesafe.Equals<Acl.PredicateMap, ReturnType<typeof predicatesSchema>> = true\n\nconst entityOperationsSchema = Typesafe.partial({\n\tread: fieldPermissionsSchema,\n\tcreate: fieldPermissionsSchema,\n\tupdate: fieldPermissionsSchema,\n\tdelete: Typesafe.union(Typesafe.string, Typesafe.boolean),\n\tcustomPrimary: Typesafe.boolean,\n\trefreshMaterializedView: Typesafe.boolean,\n\tnoRoot: Typesafe.array(Typesafe.enumeration('create', 'read', 'update', 'delete')),\n})\n\nconst opSchemaCheck: Typesafe.Equals<Acl.EntityOperations, ReturnType<typeof entityOperationsSchema>> = true\nconst entitiesSchema = Typesafe.record(\n\tTypesafe.string,\n\tTypesafe.object({\n\t\tpredicates: predicatesSchema,\n\t\toperations: entityOperationsSchema,\n\t}),\n)\nconst entitiesSchemaCheck: Typesafe.Equals<Acl.Permissions, ReturnType<typeof entitiesSchema>> = true\n\nconst baseRolePermissionsSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\tvariables: variablesSchema,\n\t\tentities: entitiesSchema,\n\t}),\n\tTypesafe.partial({\n\t\tinherits: Typesafe.array(Typesafe.string),\n\t\timplicit: Typesafe.boolean,\n\t\tstages: Typesafe.union(\n\t\t\tTypesafe.literal('*'),\n\t\t\tTypesafe.array(Typesafe.string),\n\t\t),\n\t\ttenant: tenantPermissionsSchema,\n\t\tsystem: systemPermissionsSchema,\n\t\tcontent: contentPermissionsSchema,\n\t\tdebug: Typesafe.boolean,\n\t}),\n)\nconst baseRolePermissionsCheck: Typesafe.Equals<Acl.BaseRolePermissions, ReturnType<typeof baseRolePermissionsSchema>> = true\n\nexport const aclSchema = Typesafe.intersection(\n\tTypesafe.object({\n\t\troles: Typesafe.record(\n\t\t\tTypesafe.string,\n\t\t\t(v, p): Acl.RolePermissions => {\n\t\t\t\tconst main: Acl.BaseRolePermissions = baseRolePermissionsSchema(v, p)\n\t\t\t\treturn {\n\t\t\t\t\t...(v as any),\n\t\t\t\t\t...main,\n\t\t\t\t}\n\t\t\t},\n\t\t),\n\t}),\n\tTypesafe.partial({\n\t\tcustomPrimary: Typesafe.boolean,\n\t}),\n)\nconst aclSchemaCheck: Typesafe.Equals<Acl.Schema, ReturnType<typeof aclSchema>> = true\n"],"names":[],"mappings":";;;AAIA,MAAM,4BAA4B,SAAS,MAAM,SAAS,SAAS,SAAS;AAAA,EAC3E,SAAS;AAAA,EACT,SAAS;AAAA,IACR,SAAS,QAAQ,IAAI;AAAA,IACrB,SAAS,QAAQ;AAAA,MAChB,WAAW,SAAS;AAAA,QACnB,SAAS,QAAQ,IAAI;AAAA,QACrB,SAAS;AAAA,UACR,SAAS;AAAA,UACT,SAAS,MAAM,SAAS,QAAQ,IAAI,GAAG,SAAS,MAAM;AAAA,QAAA;AAAA,MACvD;AAAA,IAED,CAAA;AAAA,EAAA;AAEH,CAAC;AAED,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,QAAQ,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAClE,iBAAiB,SAAS,MAAM,SAAS,SAAS,yBAAyB;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AACP,CAAC;AAGD,MAAM,0BAA0B,SAAS,QAAQ;AAAA,EAChD,SAAS,SAAS,MAAM,SAAS,SAAS,SAAS,YAAY,OAAO,MAAM,CAAC;AAAA,EAC7E,SAAS,SAAS;AAAA,EAClB,gBAAgB,SAAS;AAAA,EACzB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAClB,CAAC;AAGD,MAAM,2BAA2B,SAAS,QAAQ;AAAA,EACjD,kBAAkB;AAAA,EAClB,QAAQ,SAAS;AAAA,EACjB,QAAQ,SAAS;AAAA,EACjB,yBAAyB,SAAS;AACnC,CAAC;AAGD,MAAM,uBAAuB,SAAS;AAAA,EACrC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,MAAM;AAAA,IAC9C,YAAY,SAAS;AAAA,EAAA,CACrB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,2BAA2B,SAAS,OAAO;AAAA,EAChD,MAAM,SAAS,QAAQ,IAAI,aAAa,UAAU;AAAA,EAClD,OAAO,SAAS,YAAY,cAAc,UAAU;AACrD,CAAC;AACD,MAAM,0BAA0B,SAAS;AAAA,EACxC,SAAS,OAAO;AAAA,IACf,MAAM,SAAS,QAAQ,IAAI,aAAa,SAAS;AAAA,EAAA,CACjD;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,gBAAgB;AAAA,EAC1B,CAAA;AACF;AAGA,MAAM,kBAAkB,SAAS;AAAA,EAChC,SAAS;AAAA,EACT,SAAS;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEF;AAIA,MAAM,yBAAyB,SAAS;AAAA,EACvC,SAAS;AAAA,EACT,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AACjD;AACA,MAAM,mBAAmB,SAAS;AAAA,EACjC,SAAS;AAAA,EACT,CAAC,GAAG,MAA+B,SAAS,cAAc,GAAG,CAAC;AAC/D;AAIA,MAAM,yBAAyB,SAAS,QAAQ;AAAA,EAC/C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ,SAAS,MAAM,SAAS,QAAQ,SAAS,OAAO;AAAA,EACxD,eAAe,SAAS;AAAA,EACxB,yBAAyB,SAAS;AAAA,EAClC,QAAQ,SAAS,MAAM,SAAS,YAAY,UAAU,QAAQ,UAAU,QAAQ,CAAC;AAClF,CAAC;AAGD,MAAM,iBAAiB,SAAS;AAAA,EAC/B,SAAS;AAAA,EACT,SAAS,OAAO;AAAA,IACf,YAAY;AAAA,IACZ,YAAY;AAAA,EACZ,CAAA;AACF;AAGA,MAAM,4BAA4B,SAAS;AAAA,EAC1C,SAAS,OAAO;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,EAAA,CACV;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,IACxC,UAAU,SAAS;AAAA,IACnB,QAAQ,SAAS;AAAA,MAChB,SAAS,QAAQ,GAAG;AAAA,MACpB,SAAS,MAAM,SAAS,MAAM;AAAA,IAC/B;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,OAAO,SAAS;AAAA,EAChB,CAAA;AACF;AAGO,MAAM,YAAY,SAAS;AAAA,EACjC,SAAS,OAAO;AAAA,IACf,OAAO,SAAS;AAAA,MACf,SAAS;AAAA,MACT,CAAC,GAAG,MAA2B;AACxB,cAAA,OAAgC,0BAA0B,GAAG,CAAC;AAC7D,eAAA;AAAA,UACN,GAAI;AAAA,UACJ,GAAG;AAAA,QACJ;AAAA,MAAA;AAAA,IACD;AAAA,EACD,CACA;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,eAAe,SAAS;AAAA,EACxB,CAAA;AACF;"}
package/dist/production/src/validation/MembershipResolver.cjs CHANGED
@@ -12,7 +12,7 @@ var __defProp = Object.defineProperty;
12
12
  var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
13
13
  var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
14
14
  class MembershipResolver {
15
- resolve(acl, memberships, identity) {
15
+ resolve(acl, memberships, identity, isAssumed) {
16
16
  const errors = [];
17
17
  const parsed = [];
18
18
  const roles = acl.roles;
@@ -27,7 +27,7 @@ class MembershipResolver {
27
27
  }
28
28
  const roleVariables = schemaUtils.getRoleVariables(membership.role, acl);
29
29
  for (const variable of membership.variables) {
30
- if (!roleVariables[variable.name] || roleVariables[variable.name].type === schema.Acl.VariableType.predefined) {
30
+ if (!roleVariables[variable.name] || !isAssumed && roleVariables[variable.name].type === schema.Acl.VariableType.predefined) {
31
31
  errors.push(
32
32
  new MembershipValidationError(
33
33
  membership.role,
@@ -37,7 +37,7 @@ class MembershipResolver {
37
37
  );
38
38
  }
39
39
  }
40
- const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity);
40
+ const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed);
41
41
  errors.push(...membershipErrors);
42
42
  parsed.push({
43
43
  role: membership.role,
@@ -46,19 +46,23 @@ class MembershipResolver {
46
46
  }
47
47
  return new MembershipReadResult(errors, parsed);
48
48
  }
49
- readMembershipVariables(roleVariables, membership, identity) {
49
+ readMembershipVariables(roleVariables, membership, identity, isAssumed) {
50
50
  const errors = [];
51
51
  const parsedVariables = [];
52
52
  for (const [name, variable] of Object.entries(roleVariables)) {
53
+ const inputVariable = membership.variables.find((it) => it.name === name);
53
54
  if (variable.type === schema.Acl.VariableType.predefined) {
54
55
  switch (variable.value) {
55
56
  case "identityID":
56
- parsedVariables.push({ name, condition: { in: [identity.identityId] } });
57
+ parsedVariables.push({
58
+ name,
59
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] }
60
+ });
57
61
  break;
58
62
  case "personID":
59
63
  parsedVariables.push({
60
64
  name,
61
- condition: { in: identity.personId ? [identity.personId] : [] }
65
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] }
62
66
  });
63
67
  break;
64
68
  default:
@@ -68,7 +72,6 @@ class MembershipResolver {
68
72
  }
69
73
  continue;
70
74
  }
71
- const inputVariable = membership.variables.find((it) => it.name === name);
72
75
  if (!inputVariable) {
73
76
  if (variable.fallback) {
74
77
  parsedVariables.push({ name, condition: variable.fallback });
package/dist/production/src/validation/MembershipResolver.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"MembershipResolver.cjs","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl'\nimport { conditionSchema } from '../type-schema'\nimport { assertNever } from '../utils'\n\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tif (!roleVariables[variable.name] || roleVariables[variable.name].type === Acl.VariableType.predefined) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { in: [identity.identityId] } })\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["getRoleVariables","Acl","conditionSchema","assertNever","MembershipValidationErrorType"],"mappings":";;;;;;;;;;;;;AAMO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIuB;AACvB,UAAM,SAAsC,CAAC;AAC7C,UAAM,SAA6B,CAAC;AACpC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AACrC,UAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC5B,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MAAA;AAED,YAAM,gBAAgBA,YAAA,iBAAiB,WAAW,MAAM,GAAG;AAChD,iBAAA,YAAY,WAAW,WAAW;AAC5C,YAAI,CAAC,cAAc,SAAS,IAAI,KAAK,cAAc,SAAS,IAAI,EAAE,SAASC,WAAI,aAAa,YAAY;AAChG,iBAAA;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UAEX;AAAA,QAAA;AAAA,MACD;AAEK,YAAA,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,QAAQ;AACrG,aAAA,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IAAA;AAEK,WAAA,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAAA;AAAA,EAGvC,wBAAwB,eAA8B,YAA4B,UAG5B;AAC7D,UAAM,SAAsC,CAAC;AAC7C,UAAM,kBAA8C,CAAC;AACrD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,UAAI,SAAS,SAASA,WAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAO;AAAA,UACvB,KAAK;AACY,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,CAAC,SAAS,UAAU,EAAE,GAAG;AACvE;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAG,EAAA;AAAA,YAAA,CAC9D;AACD;AAAA,UACD;AACiB,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MAAA;AAGD,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAM,OAAA,GAAG,SAAS,IAAI;AACtE,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAAA,OACrD;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9F,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAE1D;AAAA,MAAA;AAGD,UAAI,SAAS,SAASA,WAAI,aAAa,QAAQ;AAC9B,wBAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAO,GAAG;AAAA,MAE5D,WAAA,SAAS,SAASA,OAAAA,IAAI,aAAa,WAAW;AACpD,YAAA;AACG,gBAAA,aAAa,cAAc,OAAO,IAAI,CAAA,OAAMC,UAAgB,gBAAA,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW;AAAA,UAAA,CACtE;AAAA,QAAA,QACM;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChG,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAAA,MAC1D,OACM;AACNC,oBAAAA,YAAoB;AAAA,MAAA;AAAA,IACrB;AAEM,WAAA,CAAC,QAAQ,eAAe;AAAA,EAAA;AAEjC;AAjGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAuC,CAAA;AAmG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAGlB;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAGlB;AAEY,IAAA,kDAAAC,mCAAL;AACNA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,oBAAqB,IAAA;AACrBA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,kBAAmB,IAAA;AAJRA,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;;;;;"}
1
+ {"version":3,"file":"MembershipResolver.cjs","sources":["../../../../../packages/schema-utils/src/validation/MembershipResolver.ts"],"sourcesContent":["import { Acl, Input } from '@contember/schema'\nimport { getRoleVariables } from '../acl'\nimport { conditionSchema } from '../type-schema'\nimport { assertNever } from '../utils'\n\n\nexport class MembershipResolver {\n\tpublic static UnknownIdentity = { identityId: '00000000-0000-0000-0000-000000000000' }\n\n\tresolve(\n\t\tacl: Acl.Schema,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tidentity: {\n\t\t\tidentityId: string\n\t\t\tpersonId?: string\n\t\t},\n\t\tisAssumed: boolean,\n\t): MembershipReadResult {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsed: ParsedMembership[] = []\n\t\tconst roles = acl.roles\n\t\tfor (const membership of memberships) {\n\t\t\tif (!roles[membership.role]) {\n\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.ROLE_NOT_FOUND))\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst roleVariables = getRoleVariables(membership.role, acl)\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tif (!roleVariables[variable.name] || (!isAssumed && roleVariables[variable.name].type === Acl.VariableType.predefined)) {\n\t\t\t\t\terrors.push(\n\t\t\t\t\t\tnew MembershipValidationError(\n\t\t\t\t\t\t\tmembership.role,\n\t\t\t\t\t\t\tMembershipValidationErrorType.VARIABLE_NOT_FOUND,\n\t\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\t),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed)\n\t\t\terrors.push(...membershipErrors)\n\t\t\tparsed.push({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: parsedVariables,\n\t\t\t})\n\t\t}\n\t\treturn new MembershipReadResult(errors, parsed)\n\t}\n\n\tprivate readMembershipVariables(roleVariables: Acl.Variables, membership: Acl.Membership, identity: {\n\t\tidentityId: string\n\t\tpersonId?: string\n\t}, isAssumed: boolean): [MembershipValidationError[], ParsedMembershipVariable[]] {\n\t\tconst errors: MembershipValidationError[] = []\n\t\tconst parsedVariables: ParsedMembershipVariable[] = []\n\t\tfor (const [name, variable] of Object.entries(roleVariables)) {\n\t\t\tconst inputVariable = membership.variables.find(it => it.name === name)\n\t\t\tif (variable.type === Acl.VariableType.predefined) {\n\t\t\t\tswitch (variable.value) {\n\t\t\t\t\tcase 'identityID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tcase 'personID':\n\t\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tcondition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] },\n\t\t\t\t\t\t})\n\t\t\t\t\t\tbreak\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (!inputVariable) {\n\t\t\t\tif (variable.fallback) {\n\t\t\t\t\tparsedVariables.push({ name, condition: variable.fallback })\n\t\t\t\t} else {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_EMPTY, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif (variable.type === Acl.VariableType.entity) {\n\t\t\t\tparsedVariables.push({ name, condition: { in: inputVariable.values } }) // todo: cast to int where primary is int\n\n\t\t\t} else if (variable.type === Acl.VariableType.condition) {\n\t\t\t\ttry {\n\t\t\t\t\tconst conditions = inputVariable.values.map(it => conditionSchema()(JSON.parse(it)))\n\t\t\t\t\tparsedVariables.push({\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tcondition: conditions.length === 1 ? conditions[0] : { or: conditions },\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\terrors.push(new MembershipValidationError(membership.role, MembershipValidationErrorType.VARIABLE_INVALID, name))\n\t\t\t\t\tparsedVariables.push({ name, condition: { never: true } })\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tassertNever(variable)\n\t\t\t}\n\t\t}\n\t\treturn [errors, parsedVariables]\n\t}\n}\n\nexport class MembershipReadResult {\n\tconstructor(\n\t\tpublic readonly errors: MembershipValidationError[],\n\t\tpublic readonly memberships: ParsedMembership[],\n\t) {\n\t}\n}\n\nexport class MembershipValidationError {\n\tconstructor(\n\t\tpublic readonly role: string,\n\t\tpublic readonly error: MembershipValidationErrorType,\n\t\tpublic readonly variable?: string,\n\t) {\n\t}\n}\n\nexport enum MembershipValidationErrorType {\n\tROLE_NOT_FOUND = 'roleNotFound',\n\tVARIABLE_NOT_FOUND = 'variableNotFound',\n\tVARIABLE_EMPTY = 'variableEmpty',\n\tVARIABLE_INVALID = 'variableInvalid',\n}\n\n\nexport interface ParsedMembershipVariable {\n\treadonly name: string\n\treadonly condition: Input.Condition\n}\n\nexport interface ParsedMembership {\n\treadonly role: string\n\treadonly variables: readonly ParsedMembershipVariable[]\n}\n"],"names":["getRoleVariables","Acl","conditionSchema","assertNever","MembershipValidationErrorType"],"mappings":";;;;;;;;;;;;;AAMO,MAAM,mBAAmB;AAAA,EAG/B,QACC,KACA,aACA,UAIA,WACuB;AACvB,UAAM,SAAsC,CAAC;AAC7C,UAAM,SAA6B,CAAC;AACpC,UAAM,QAAQ,IAAI;AAClB,eAAW,cAAc,aAAa;AACrC,UAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC5B,eAAO,KAAK,IAAI;AAAA,UAA0B,WAAW;AAAA,UAAM;AAAA;AAAA,SAA6C;AACxG;AAAA,MAAA;AAED,YAAM,gBAAgBA,YAAA,iBAAiB,WAAW,MAAM,GAAG;AAChD,iBAAA,YAAY,WAAW,WAAW;AAC5C,YAAI,CAAC,cAAc,SAAS,IAAI,KAAM,CAAC,aAAa,cAAc,SAAS,IAAI,EAAE,SAASC,OAAAA,IAAI,aAAa,YAAa;AAChH,iBAAA;AAAA,YACN,IAAI;AAAA,cACH,WAAW;AAAA,cACX;AAAA,cACA,SAAS;AAAA,YAAA;AAAA,UAEX;AAAA,QAAA;AAAA,MACD;AAEK,YAAA,CAAC,kBAAkB,eAAe,IAAI,KAAK,wBAAwB,eAAe,YAAY,UAAU,SAAS;AAChH,aAAA,KAAK,GAAG,gBAAgB;AAC/B,aAAO,KAAK;AAAA,QACX,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,MAAA,CACX;AAAA,IAAA;AAEK,WAAA,IAAI,qBAAqB,QAAQ,MAAM;AAAA,EAAA;AAAA,EAGvC,wBAAwB,eAA8B,YAA4B,UAGvF,WAA+E;AACjF,UAAM,SAAsC,CAAC;AAC7C,UAAM,kBAA8C,CAAC;AACrD,eAAW,CAAC,MAAM,QAAQ,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC7D,YAAM,gBAAgB,WAAW,UAAU,KAAK,CAAM,OAAA,GAAG,SAAS,IAAI;AACtE,UAAI,SAAS,SAASA,WAAI,aAAa,YAAY;AAClD,gBAAQ,SAAS,OAAO;AAAA,UACvB,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,CAAC,SAAS,UAAU,EAAE;AAAA,YAAA,CAC3F;AACD;AAAA,UACD,KAAK;AACJ,4BAAgB,KAAK;AAAA,cACpB;AAAA,cACA,WAAW,EAAE,IAAI,aAAa,gBAAgB,cAAc,SAAS,SAAS,WAAW,CAAC,SAAS,QAAQ,IAAI,CAAG,EAAA;AAAA,YAAA,CAClH;AACD;AAAA,UACD;AACiB,4BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AACzD,mBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChH;AAAA,QAAA;AAEF;AAAA,MAAA;AAGD,UAAI,CAAC,eAAe;AACnB,YAAI,SAAS,UAAU;AACtB,0BAAgB,KAAK,EAAE,MAAM,WAAW,SAAS,UAAU;AAAA,QAAA,OACrD;AACN,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,iBAA8C,IAAI,CAAC;AAC9F,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAE1D;AAAA,MAAA;AAGD,UAAI,SAAS,SAASA,WAAI,aAAa,QAAQ;AAC9B,wBAAA,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,cAAc,OAAO,GAAG;AAAA,MAE5D,WAAA,SAAS,SAASA,OAAAA,IAAI,aAAa,WAAW;AACpD,YAAA;AACG,gBAAA,aAAa,cAAc,OAAO,IAAI,CAAA,OAAMC,UAAgB,gBAAA,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;AACnF,0BAAgB,KAAK;AAAA,YACpB;AAAA,YACA,WAAW,WAAW,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW;AAAA,UAAA,CACtE;AAAA,QAAA,QACM;AACP,iBAAO,KAAK,IAAI,0BAA0B,WAAW,MAAM,mBAAgD,IAAI,CAAC;AAChG,0BAAA,KAAK,EAAE,MAAM,WAAW,EAAE,OAAO,KAAA,GAAQ;AAAA,QAAA;AAAA,MAC1D,OACM;AACNC,oBAAAA,YAAoB;AAAA,MAAA;AAAA,IACrB;AAEM,WAAA,CAAC,QAAQ,eAAe;AAAA,EAAA;AAEjC;AArGC,cADY,oBACE,mBAAkB,EAAE,YAAY,uCAAuC,CAAA;AAuG/E,MAAM,qBAAqB;AAAA,EACjC,YACiB,QACA,aACf;AAFe,SAAA,SAAA;AACA,SAAA,cAAA;AAAA,EAAA;AAGlB;AAEO,MAAM,0BAA0B;AAAA,EACtC,YACiB,MACA,OACA,UACf;AAHe,SAAA,OAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAGlB;AAEY,IAAA,kDAAAC,mCAAL;AACNA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,oBAAqB,IAAA;AACrBA,iCAAA,gBAAiB,IAAA;AACjBA,iCAAA,kBAAmB,IAAA;AAJRA,SAAAA;AAAA,GAAA,iCAAA,CAAA,CAAA;;;;;"}
package/dist/production/src/validation/MembershipResolver.js CHANGED
@@ -10,7 +10,7 @@ var __defProp = Object.defineProperty;
10
10
  var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
11
11
  var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
12
12
  class MembershipResolver {
13
- resolve(acl, memberships, identity) {
13
+ resolve(acl, memberships, identity, isAssumed) {
14
14
  const errors = [];
15
15
  const parsed = [];
16
16
  const roles = acl.roles;
@@ -25,7 +25,7 @@ class MembershipResolver {
25
25
  }
26
26
  const roleVariables = getRoleVariables(membership.role, acl);
27
27
  for (const variable of membership.variables) {
28
- if (!roleVariables[variable.name] || roleVariables[variable.name].type === Acl.VariableType.predefined) {
28
+ if (!roleVariables[variable.name] || !isAssumed && roleVariables[variable.name].type === Acl.VariableType.predefined) {
29
29
  errors.push(
30
30
  new MembershipValidationError(
31
31
  membership.role,
@@ -35,7 +35,7 @@ class MembershipResolver {
35
35
  );
36
36
  }
37
37
  }
38
- const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity);
38
+ const [membershipErrors, parsedVariables] = this.readMembershipVariables(roleVariables, membership, identity, isAssumed);
39
39
  errors.push(...membershipErrors);
40
40
  parsed.push({
41
41
  role: membership.role,
@@ -44,19 +44,23 @@ class MembershipResolver {
44
44
  }
45
45
  return new MembershipReadResult(errors, parsed);
46
46
  }
47
- readMembershipVariables(roleVariables, membership, identity) {
47
+ readMembershipVariables(roleVariables, membership, identity, isAssumed) {
48
48
  const errors = [];
49
49
  const parsedVariables = [];
50
50
  for (const [name, variable] of Object.entries(roleVariables)) {
51
+ const inputVariable = membership.variables.find((it) => it.name === name);
51
52
  if (variable.type === Acl.VariableType.predefined) {
52
53
  switch (variable.value) {
53
54
  case "identityID":
54
- parsedVariables.push({ name, condition: { in: [identity.identityId] } });
55
+ parsedVariables.push({
56
+ name,
57
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : [identity.identityId] }
58
+ });
55
59
  break;
56
60
  case "personID":
57
61
  parsedVariables.push({
58
62
  name,
59
- condition: { in: identity.personId ? [identity.personId] : [] }
63
+ condition: { in: isAssumed && inputVariable ? inputVariable.values : identity.personId ? [identity.personId] : [] }
60
64
  });
61
65
  break;
62
66
  default:
@@ -66,7 +70,6 @@ class MembershipResolver {
66
70
  }
67
71
  continue;
68
72
  }
69
- const inputVariable = membership.variables.find((it) => it.name === name);
70
73
  if (!inputVariable) {
71
74
  if (variable.fallback) {
72
75
  parsedVariables.push({ name, condition: variable.fallback });